snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/rooms/invites/findOrCreateInvite.ts

@@ -0,0 +1,126 @@
+import { api } from '@rocket.chat/core-services';
+import type { IInvite } from '@rocket.chat/core-typings';
+import { Invites, Subscriptions, Rooms } from '@rocket.chat/models';
+import { Random } from '@rocket.chat/random';
+import { Meteor } from 'meteor/meteor';
+
+import { RoomMemberActions } from '../../../../definition/IRoomTypeConfig';
+import { settings } from '../../../settings';
+import { hasPermissionAsync } from '../../authorization/hasPermission';
+import { getURL } from '../../utils/getURL';
+import { roomCoordinator } from '../roomCoordinator';
+
+function getInviteUrl(invite: Omit<IInvite, '_updatedAt'>) {
+	const { _id } = invite;
+
+	const useDirectLink = settings.get<string>('Accounts_Registration_InviteUrlType') === 'direct';
+
+	return getURL(
+		`invite/${_id}`,
+		{
+			full: useDirectLink,
+			cloud: !useDirectLink,
+			cloud_route: 'invite',
+		},
+		settings.get<string>('DeepLink_Url'),
+	);
+}
+
+const possibleDays = [0, 1, 7, 15, 30];
+const possibleUses = [0, 1, 5, 10, 25, 50, 100];
+
+export const findOrCreateInvite = async (userId: string, invite: Pick<IInvite, 'rid' | 'days' | 'maxUses'>) => {
+	if (!userId || !invite) {
+		return false;
+	}
+
+	if (!invite.rid) {
+		throw new Meteor.Error('error-the-field-is-required', 'The field rid is required', {
+			method: 'findOrCreateInvite',
+			field: 'rid',
+		});
+	}
+
+	if (!(await hasPermissionAsync(userId, 'create-invite-links', invite.rid))) {
+		throw new Meteor.Error('not_authorized');
+	}
+
+	const subscription = await Subscriptions.findOneByRoomIdAndUserId(invite.rid, userId, {
+		projection: { _id: 1 },
+	});
+	if (!subscription) {
+		throw new Meteor.Error('error-invalid-room', 'The rid field is invalid', {
+			method: 'findOrCreateInvite',
+			field: 'rid',
+		});
+	}
+
+	const room = await Rooms.findOneById(invite.rid);
+	if (!room) {
+		throw new Meteor.Error('error-invalid-room', 'The rid field is invalid', {
+			method: 'findOrCreateInvite',
+			field: 'rid',
+		});
+	}
+
+	if (settings.get('ABAC_Enabled') && room?.abacAttributes?.length) {
+		throw new Meteor.Error('error-invalid-room', 'Room is ABAC managed', {
+			method: 'findOrCreateInvite',
+			field: 'rid',
+		});
+	}
+
+	if (!(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.INVITE, userId))) {
+		throw new Meteor.Error('error-room-type-not-allowed', 'Cannot create invite links for this room type', {
+			method: 'findOrCreateInvite',
+		});
+	}
+
+	const { days = 1, maxUses = 0 } = invite;
+
+	if (!possibleDays.includes(days)) {
+		throw new Meteor.Error('invalid-number-of-days', 'Invite should expire in 1, 7, 15 or 30 days, or send 0 to never expire.');
+	}
+
+	if (!possibleUses.includes(maxUses)) {
+		throw new Meteor.Error('invalid-number-of-uses', 'Invite should be valid for 1, 5, 10, 25, 50, 100 or infinite (0) uses.');
+	}
+
+	// Before anything, let's check if there's an existing invite with the same settings for the same channel and user and that has not yet expired.
+	const existing = await Invites.findOneByUserRoomMaxUsesAndExpiration(userId, invite.rid, maxUses, days);
+
+	// If an existing invite was found, return it's _id instead of creating a new one.
+	if (existing) {
+		existing.url = getInviteUrl(existing);
+		return existing;
+	}
+
+	const _id = Random.id(6);
+
+	// insert invite
+	const createdAt = new Date();
+	let expires = null;
+	if (days > 0) {
+		expires = new Date(createdAt);
+		expires.setDate(expires.getDate() + days);
+	}
+
+	const createInvite: Omit<IInvite, '_updatedAt'> = {
+		_id,
+		days,
+		maxUses,
+		rid: invite.rid,
+		userId,
+		createdAt,
+		expires,
+		url: '',
+		uses: 0,
+	};
+
+	await Invites.insertOne(createInvite);
+
+	void api.broadcast('notify.updateInvites', userId, { invite: createInvite });
+
+	createInvite.url = getInviteUrl(createInvite);
+	return createInvite;
+};

apps/meteor/server/lib/rooms/invites/listInvites.ts

@@ -0,0 +1,16 @@
+import { Invites } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { hasPermissionAsync } from '../../authorization/hasPermission';
+
+export const listInvites = async (userId: string) => {
+	if (!userId) {
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'listInvites' });
+	}
+
+	if (!(await hasPermissionAsync(userId, 'create-invite-links'))) {
+		throw new Meteor.Error('not_authorized');
+	}
+
+	return Invites.find({}).toArray();
+};

apps/meteor/server/lib/rooms/invites/removeInvite.ts

@@ -0,0 +1,32 @@
+import type { IInvite } from '@rocket.chat/core-typings';
+import { Invites } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { hasPermissionAsync } from '../../authorization/hasPermission';
+
+export const removeInvite = async (userId: string, invite: Pick<IInvite, '_id'>) => {
+	if (!userId || !invite) {
+		return false;
+	}
+
+	if (!(await hasPermissionAsync(userId, 'create-invite-links'))) {
+		throw new Meteor.Error('not_authorized');
+	}
+
+	if (!invite._id) {
+		throw new Meteor.Error('error-the-field-is-required', 'The field _id is required', {
+			method: 'removeInvite',
+			field: '_id',
+		});
+	}
+
+	const { deletedCount } = await Invites.removeById(invite._id);
+
+	if (!deletedCount) {
+		throw new Meteor.Error('invalid-invitation-id', 'Invalid Invitation _id', {
+			method: 'removeInvite',
+		});
+	}
+
+	return true;
+};

apps/meteor/server/lib/rooms/invites/sendInvitationEmail.ts

@@ -0,0 +1,70 @@
+import { Settings } from '@rocket.chat/models';
+import { check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+
+import { settings } from '../../../settings';
+import { hasPermissionAsync } from '../../authorization/hasPermission';
+import * as Mailer from '../../notifications/email/api';
+import { notifyOnSettingChanged } from '../../notifyListener';
+
+let html = '';
+Meteor.startup(() => {
+	Mailer.getTemplate('Invitation_Email', (value) => {
+		html = value;
+	});
+});
+
+export const sendInvitationEmail = async (userId: string, emails: string[]) => {
+	check(emails, [String]);
+	if (!userId) {
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+			method: 'sendInvitationEmail',
+		});
+	}
+	if (!(await hasPermissionAsync(userId, 'bulk-register-user'))) {
+		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
+			method: 'sendInvitationEmail',
+		});
+	}
+	const validEmails = emails.filter(Mailer.checkAddressFormat);
+
+	if (!validEmails || validEmails.length === 0) {
+		throw new Meteor.Error('error-email-send-failed', 'No valid email addresses', {
+			method: 'sendInvitationEmail',
+		});
+	}
+
+	const subject = settings.get<string>('Invitation_Subject');
+
+	if (!subject) {
+		throw new Meteor.Error('error-email-send-failed', 'No subject', {
+			method: 'sendInvitationEmail',
+		});
+	}
+
+	for (const email of validEmails) {
+		try {
+			await Mailer.send({
+				to: email,
+				from: settings.get('From_Email'),
+				subject,
+				html,
+				data: {
+					email,
+				},
+			});
+
+			const value = await Settings.incrementValueById('Invitation_Email_Count', 1, { returnDocument: 'after' });
+			if (value) {
+				void notifyOnSettingChanged(value);
+			}
+
+			continue;
+		} catch ({ message }: any) {
+			throw new Meteor.Error('error-email-send-failed', `Error trying to send email: ${message}`, {
+				method: 'sendInvitationEmail',
+				message,
+			});
+		}
+	}
+};

apps/meteor/server/lib/rooms/invites/useInviteToken.ts

@@ -0,0 +1,69 @@
+import { isBannedSubscription } from '@rocket.chat/core-typings';
+import { Invites, Subscriptions, Users } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { validateInviteToken } from './validateInviteToken';
+import { RoomMemberActions } from '../../../../definition/IRoomTypeConfig';
+import { addUserToRoom } from '../addUserToRoom';
+import { roomCoordinator } from '../roomCoordinator';
+
+export const useInviteToken = async (userId: string, token: string) => {
+	if (!userId) {
+		throw new Meteor.Error('error-invalid-user', 'The user is invalid', {
+			method: 'useInviteToken',
+			field: 'userId',
+		});
+	}
+
+	if (!token) {
+		throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', {
+			method: 'useInviteToken',
+			field: 'token',
+		});
+	}
+
+	const { inviteData, room } = await validateInviteToken(token);
+
+	if (!(await roomCoordinator.getRoomDirectives(room.t).allowMemberAction(room, RoomMemberActions.INVITE, userId))) {
+		throw new Meteor.Error('error-room-type-not-allowed', "Can't join room of this type via invite", {
+			method: 'useInviteToken',
+			field: 'token',
+		});
+	}
+
+	const user = await Users.findOneById(userId);
+	if (!user) {
+		throw new Meteor.Error('error-invalid-user', 'The user is invalid', {
+			method: 'useInviteToken',
+			field: 'userId',
+		});
+	}
+	const subscription = await Subscriptions.findOneByRoomIdAndUserId(room._id, user._id);
+	if (subscription && isBannedSubscription(subscription)) {
+		throw new Meteor.Error('error-user-is-banned', 'User is banned from this room', {
+			method: 'useInviteToken',
+		});
+	}
+
+	await Users.updateInviteToken(user._id, token);
+
+	if (!subscription) {
+		await Invites.increaseUsageById(inviteData._id, 1);
+	}
+
+	// If the user already has an username, then join the invite room,
+	// If no username is set yet, then the the join will happen on the setUsername method
+	if (user.username) {
+		await addUserToRoom(room._id, user);
+	}
+
+	return {
+		room: {
+			rid: inviteData.rid,
+			prid: room.prid,
+			fname: room.fname,
+			name: room.name,
+			t: room.t,
+		},
+	};
+};

apps/meteor/server/lib/rooms/invites/validateInviteToken.ts

@@ -0,0 +1,55 @@
+import { Invites, Rooms } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { settings } from '../../../settings';
+
+export const validateInviteToken = async (token: string) => {
+	if (!token || typeof token !== 'string') {
+		throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', {
+			method: 'validateInviteToken',
+			field: 'token',
+		});
+	}
+
+	const inviteData = await Invites.findOneById(token);
+	if (!inviteData) {
+		throw new Meteor.Error('error-invalid-token', 'The invite token is invalid.', {
+			method: 'validateInviteToken',
+			field: 'token',
+		});
+	}
+
+	const room = await Rooms.findOneById(inviteData.rid);
+	if (!room) {
+		throw new Meteor.Error('error-invalid-room', 'The invite token is invalid.', {
+			method: 'validateInviteToken',
+			field: 'rid',
+		});
+	}
+
+	if (settings.get('ABAC_Enabled') && room?.abacAttributes?.length) {
+		throw new Meteor.Error('error-invalid-room', 'Room is ABAC managed', {
+			method: 'validateInviteToken',
+			field: 'rid',
+		});
+	}
+
+	if (inviteData.expires && new Date(inviteData.expires).getTime() <= Date.now()) {
+		throw new Meteor.Error('error-invite-expired', 'The invite token has expired.', {
+			method: 'validateInviteToken',
+			field: 'expires',
+		});
+	}
+
+	if (inviteData.maxUses > 0 && inviteData.uses >= inviteData.maxUses) {
+		throw new Meteor.Error('error-invite-expired', 'The invite token has expired.', {
+			method: 'validateInviteToken',
+			field: 'maxUses',
+		});
+	}
+
+	return {
+		inviteData,
+		room,
+	};
+};